Could a law designed to prevent computer fraud unintentionally make criminals out of millions of Americans who use services such as Netflix and Amazon? That is precisely what one federal judge sees as the potential outcome of a recent ruling in the U.S. Court of Appeals for the Ninth Circuit.
“Criminalizing All Sorts of Innocuous Conduct”
The case, United States v. Nosal, concerned a violation of the 1984 Computer Fraud and Abuse Act (CFAA), which is a federal law that makes it a crime to engage in the unauthorized use of a computer or network. The law has been amended numerous times since its enactment, and in its present form, it is essentially an anti-hacking law.
David Nosal’s case, however, was a little different than a typical hacking case. Nosal left his position at his company after he was denied a promotion. He decided to build a company to compete against his former employer. He and his associates began accessing the company’s databases by using his former assistant’s password.
Nosal was charged with conspiracy, theft of trade secrets, and three counts of computer fraud under the CFAA. He received a prison sentence, probation, and was ordered to pay $900,000 in restitution and fines.
Is It a Crime to Share Your Netflix Password?
For dissenting justice Stephen Reinhardt, the phrase “without authorization” is the one that is most troubling about the upholding of Nosal’s conviction. He notes that the sharing of a password is something that millions of Americans do each day.
“People frequently share their passwords, notwithstanding the fact that websites and employers have policies prohibiting it. In my view, the CFAA does not make the millions of people who engage in this ubiquitous, useful, and generally harmless conduct into unwitting federal criminals,” he wrote in his dissenting opinion.
Reinhardt’s worries are not baseless. People who have violated the “Terms of Service” that users are required to agree to before they can use many computer-based services have been prosecuted in the past. Whenever Netflix updates its Terms of Service, a user of its streaming service will be greeted upon logging in with a lengthy legal notice on-screen that explains the rules for how the service can be used. A subscriber must accept these terms by clicking the on-screen button before they can access the service. Even more problematic is that many people do not bother to read those terms before agreeing to them. Continue reading →